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We present a unified formalism for thresliold quantum secret sharing using graph states of systems 
with prime dimension. We construct protocols for three varieties of secret sharing: with classical 
and quantum secrets shared between parties over both classical and quantum channels. 
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I. INTRODUCTION 

"Secret sharing" refers to an important family of mul- 
tiparty cryptographic protocols in both the classical [H, 0| 
and the quantum ^SnS] contexts. A secret sharing pro- 
tocol comprises a dealer and n players who are intercon- 
nected by some set of classical or quantum channels. The 
"secret" to be shared is a classical string or quantum state 
and is distributed among the players by the dealer in such 
a way that it can only be recovered by certain subsets of 
players acting collaboratively. The access structure is the 
set of all subsets of players who can recover the secret, 
and the adversary structure corresponds to those subsets 
that obtain no knowledge of the secret. There may, in 
addition, be external eavesdroppers who should also gain 
no knowledge of the secret. Secret sharing protocols have 
practical applications in, for example, money transfer Q 
and voting [7l| schemes. Recently, a unified formalism for 
a range of protocols for sharing both classical and quan- 
tum secrets using qubit graph states [1] has been pro- 
posed Q. The formalism allows for both classical and 
quantum channels between the dealer and players and 
covers three common varieties of secret sharing within a 
single framework. In this paper we develop an analogous 
formalism for the case of systems of prime-dimensional 
quantum states. 

Although qubit systems are generally the most 
straightforward to describe and the theory of qubit graph 
states is well-developed, there are good reasons to con- 
sider higher-dimensional systems as well. If players' 
shares consist of such systems, it may be more efficient 
to make direct use of the larger Hilbert space than to 
work with encoded qubits. Additionally, certain access 
structures are known not to be possible using the existing 
secret sharing schemes on qubit graph states Q or, in 
some cases, using any scheme with qubit shares. An ex- 
ample of the latter (which can, however, be implemented 
using qutrits) was given by Cleve, Gottesman, and Lo 
A more broad justification is that one often needs 
to consider higher-dimensional states in order to derive 
rigorous general results in quantum information theory, 
such as in certain no-go theorems (lol - [l3 |. 

Our aim is therefore to find a unified formalism for se- 
cret sharing that is not restricted to the qubit case. As 



discussed recently [l^, [T3| , graph and stabilizer states 
can be extended to the qudit case for prime dimensions. 
Following this approach, we find direct extensions of the 
existing qubit protocols @ in d dimensions, where d is 
prime i.e. we find protocols for sharing classical secrets 
with d possible values and secret quantum states within a 
d-dimensional Hilbert space, using graph states shared by 
a dealer and players, each with a d-dimensional subsys- 
tem. Our work therefore achieves, in higher-dimensional 
systems, the goals previously achieved for qubits @, 
namely, providing a general graph-state unification for 
sharing classical and quantum secrets using both classi- 
cal and quantum channels, and in this way extends the 
protocols to more general access structures. Note that 
we are primarily demonstrating how a subset of existing 
secret sharing protocols, already known to be achievable, 
can be unified within our formalism; we are not attempt- 
ing to address via the formalism any existing limitations 
in quantum and classical secret sharing. Additionally, 
however, we have demonstrated protocols within our for- 
malism which have not been previously shown: the case 
of three parties sharing classical secrets distributed over 
quantum channels (secure or insecure), in which a mini- 
mum of two parties are required to recover the secret. 

In general, there are many different possible access 
structures for secret sharing schemes. In our work we 
consider the specific case of threshold secret sharing. In 
such a scheme the secret can be recovered if and only 
if any k of the n players collaborate to do so (and any 
set of fewer than k players are denied any knowledge of 
the secret). All that is required is that enough players 
collaborate; i.e. it does not matter which k players do so. 
Thus the access structure comprises any set of at least k 
players, with the remainder forming the adversary struc- 
ture. This is denoted as a (fc,n) threshold secret sharing 
scheme. Note that one can construct arbitrary access 
structures for both classical 'l5] and quantum Q secret 
sharing by concatenating threshold protocols; thus it is 
sufficient to consider only threshold secret sharing to ad- 
dress general secret sharing. 

Here we consider three specific varieties of such 
schemes previously demonstrated in qubit graph states 
0] . We note that all existing forms of secret sharing that 
have been proposed fall into one of these categories. 
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1. CC schemes: The secret is classical, the dealer is 
connected to the players via private quantum chan- 
nels and all players are connected by private clas- 
sical channels. 

2. CQ schemes: The secret is classical, the dealer 
shares public quantum channels with each player 
and the players are connected to each other by pri- 
vate classical channels. 

3. QQ schemes: The secret is quantum, the dealer 
shares either private or public quantum channels 
with each player and the players are connected to 
each other by private quantum or classical chan- 
nels. 

In Sec. nil we formally define the structure and graph- 
ical representation of graph states for qudits and explain 
how classical information can be encoded on to such 
states and later accessed. In Sec. Ill Dl we show the ef- 
fect of local (d-dimensional) Pauli measurements on qu- 
dit graphs and derive rules (partially shown previously 
[S]) for the form of the consequent- reduced graph states, 
analogous to "local complementation" in the qubit case. 
In Sec, mil we demonstrate specific CC, CQ and QQ pro- 
tocols which may be implemented in qudit graphs given 
the properties previously derived (though we note that in 
the case of the (n, n) QQ scheme, the secret is not per- 
fectly denied to the adversary structure). We present, 
as an example of the power of higher dimensions, the 
(2, 3) case, which is not possible with qubit graph state 
schemes p|, as well as higher-dimensional analogues to 
those presented in 6]. 



II. GRAPH STATES FOR QUDITS 

Graph states [11] are a class of entangled multipar- 
tite states (including the well-known n-qubit GHZ state) 
of wide interest in quantum information. Their useful 
properties include a convenient graphical representation 
and characterisation within the stabilizer formalism , 
as well as their practical application within information 
processing, in particular for computation [isj and error 
correction [3, [l^ [20| , and their amenability for the rep- 
resentation of information flow [§, [2l| . Such states have 
been created and applied in this way for up to six qubits 
[2^ [23} , and recent work 14 [ has considered the case of 
higher-dimensional graph states. We employ the same 
framework in sections IIIBI and III Al as that in previous 
work 0, [ij, although we use different notation more 
suited to secret sharing. 



A. Graph states 

We now introduce qudit graph states and their graph- 
ical representation. Consider a finite field of order d. 
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FIG. 1. A 5-qudit graph in d = 7 and associated adjacency 
matrix A 



where d is a prime number > 2, and a weighted undi- 
rected graph i.e. a set of n vertices V = {v^} joined by a 
set of edges E = {eij = {vi,Vj}}. 

Each edge e^j has an assigned "weight" Aij G F^. E 
only contains edges with non-zero weights: a weight of 
zero corresponds to two vertices not being joined by an 
edge. No vertex is joined to itself. We can summarise 
this information in an n x n "adjacency matrix" A with 



elements Aij . We therefore have Aij 



Aji for all Vi , Vj e 



V and Au = for all V; e V. 

We define the computational basis {|j) | j G F^}. Then 
the graph state represented by the above graphical con- 
struction is 



|G) := n 



(1) 



where we define the two-qudit controlled- Z operator 

Cab\j)a\k)b.^u;'''\j)a\k)b, (2) 

the operator 

" (3) 



U\z) := 

j6Fd 



and the basis 



(4) 



An example graph and associated adjacency matrix are 
depicted in Fig. [TJ 



B. Local operators and labelling 

Here, in an analogous way to the qubit case @, we 
describe the encoding of classical information onto the 
graph state by applying local operators to the individual 
qudits that are graphically represented by the vertices of 
the graph. Here and later we make use of the generalized 
Pauli operators [23 - l26j 



X\j) 



b + 



(5) 
(6) 
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where w = e^'^*/''. These operators satisfy X*^ = Z'^ = I. 
(It follows that ZX — ujXZ and that the eigenstates 
of the operators Z, X, XZ^Z"^ . . . XZ'''^ form a set of 
mutually unbiased bases . We consider only this sub- 
set of the general operators X^Z" as they are sufficient 
for defining the graph-state stabilizers and for our secret 
sharing protocols.) We further define the operator 

S\j):^co^(^^-'^/'\j}. (7) 

which satisfies SZ ^ ZS and SXS-^ = XZ. 

In a labelled graph state each vertex is assigned a 
label ii := {zi,Xi,mi), where Zi,Xi,mi £ F^. Denoting 
an operator O acting on a vertex Vi as Oi, the graph 
state is labelled by applying the operators S'™'X,f 
to the state \G). We describe the combined labels for 
all vertices by £ := {z, x, m), where z := (zi, Z2 • ■ • , Zn), 
and similarly for x and m. We use the notation 

Z^ := Zl' ®Zl^®...® Zl- (8) 

and similarly for X and S. Thus the labelled graph state 
is 

IG^) :=5"^X"Z"|G). (9) 

Note that our definition differs from that used previously 
for qubits in that we apply the S operators after the 
X operators rather than before. 

Finally, we define an encoded graph state as a labelled 
graph state with x = 0. 



C. Stabilizers 

Higher-dimensional graph states can be represented 
within the stabilizer formalism [1, [l^ [l^ . The encoded 
graph state with labels £ satisfies, for each vertex (l^ . 

K,\Ge) =u-''\Ge) (10) 

where 

(XZ'"')»^^% (11) 
and we define, for a qudit operator O and scalar multiple 

QkA^ := Yl 0^^^\ (12) 
v,ev 

The \Ki\ is thus a set of stabilizers for the encoded 
graph state, and |G^) is the unique state (up to a global 
phase) satisfying ([TUl) for all vertices Vi. Note that the 
{ JCi} are tensor products of local operators; thus, even in 
the absence of any quantum communication, the value of 
Ki may be measured through local operations and classi- 
cal communication (LOCC) by the appropriate subset of 
parties combining their local measurement results. Note 



also that we need only consider exponents of these local 
operators modulo d. 

It follows from (|lip and ([9]) and the commutation re- 
lations of Sec. Ill Bl that applying the stabilizer Ki to a 
labelled graph state jG^) is equivalent (up to a global 
phase) to implementing the label change — >■ -1- 1 , 
Zj — )• Zj + Aij (mod d) for all e^j € E; i.e. 

\Gt) = S""X==Z^|G) cx S'^X''X,Z^Z^'\G) (13) 

Thus the two different labellings correspond to the same 
physical state. As in the qubit case [Gj, we can exploit 
this property to determine the state's dependence on par- 
ticular qudit labels. 



D. Local measurements 

Our CQ and QQ protocols involve one of the parties as 
a designated "dealer", whose local measurement on her 
own qudit produces a reduced graph state shared by the 
other parties with some access structure and labelling 
determined by the dealer's measurement outcome. We 
therefore consider the effect of local measurements on 
qudit graph states. This has previously been determined 
in the qubit case. 

We will closely follow the derivation for the effect of 
measurements on qubit graphs in Q , the results of which 
were used in Q. The results below for the effect of lo- 
cal measurement on the adjacency matrix were previ- 
ously derived [13] in the context of local complementa- 
tion [1, [2^, although here we also explicitly derive the 
effect of local measurement on the graph labels. We find 
the following: 

Proposition 1. Given an encoded graph state |G^), sup- 
pose a measurement of {X™Z)i yields the value w*. Then 
the resultant labelled graph state is obtained by the fol- 
lowing procedure: 

(Ml) For each pair j, k of distinct neighbours of i, change 

(M2) Relabel each vertex j by Zj 1— > Zj + AijS + mAijZi + 
m Aij {Aij -I- l)/2 and raj H> rnAfj. 

(M3) Remove vertex i and corresponding edges. 

Proof. We first introduce the operators U and R, defined 
as 

U\k):=Y,u=''\j) (14) 

R:^U-^S-^U. (15) 

It follows that UXU-^ = Z, and UZU'^ = X'K We 
also have [R,X] = [S,Z] = 0, and RZR-^ = SXS-^ = 
XZ; i.e. the R operator performs a, Z ^ XZ basis 
transformation just as S performs X o XZ. 
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For each local Pauli operator O = X^Z™, we define 
the operator Po,ji which is the projection onto the u^- 
eigenspace of O: 



(16) 



We first consider the case m = where the projective 
measurement is of Zj. We have 



\Gl) = n Cpn^\GA^^ 



V\vi 



(17) 



v,ev 



where \Gt, \ v^) denotes the graph state with vertex 
and all its edges removed, and V \ denotes the set all 
of players excluding player i. Next, noting that 



kAi 



(18) 



n = n E (^^^'^o.^r^- - e ^p^,^)^^ 

we have 

{PzMGi) = {Pz^sh n <"|0)^|G£\v,)v\v. 

{Pz.s)^[Yl iPz,k\Z''^^) |0),|G, \ V,)v\v, 

(19) 
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Now we consider the case m 7^ 0. Let 
ii := i?j ^S* . 

where we define 

Then, for each Vj e V, 



(20) 
(21) 



'""'^iCj, (22) 

where K'^ = Equation (HH fol- 

lows from the relation 

(X-^Z)^'^ ^^A..(^..-i)/2j^-A..^^... (23) 

Thus, noting that Ki commutes with L^, we have 

^/ ^^-™a,,(a.,+i)/2^™^™a.,^^.^_„^ (24) 

so 



The state L'^\Gt), which we will denote |t™(G^)), is 
therefore an encoded graph state |r™(G£)), stabilized by 




d = 5 



(XZ2)i =©• 
\> 1 



(1,0,1) 




(0,0,3) 



(1,0,1) 



FIG. 2. Effect of a local XZ^ measurement (with result lo^) 
on vertex 1 of an encoded-square qudit graph with weight-2 
edges in d = 5. Labels are denoted [z,x,m). Following the 
measurement, vertex 1 and all its edges are removed. Vertices 
2 and 3 gain an edge of weight A^23 = 0+6 = 1 (modulo d = 5) 
and vertex labels 2 = 1+ 4 + 4 + 6 = 0, m = 8 = 3. 



the K'j operators. The structure (i.e. the adjacency ma- 
trix) of the graph T^{Ge) is given by equating the A'^ 
for each vertex to the Ai given in the standard form for 
graph-state stabilizers in (|lip. and we similarly find the 
labels 

z'j = Zj + mAijZ^ + m^y (Ay + l)/2. (26) 
We also have 



d 

fceFd 

ke¥d 
= {Px'^^Z.sh- 



(27) 



Thus we compute 

{Px'^^zMGi) 

^ Lr"\Pz.shLT\G^) 

= -^(i?'"|.)).(5"^?Z^-^'|rr(G,)\v,))v\v,. (28) 

Hence a local measurement of XZ™ on the vertex v.; gives 
the graph \t™{Gi)) with the Vi vertex removed and ad- 
ditional labelling operators S'™^* Z*^' applied. □ 

The reduced-state graph transformation given in Ml 
can be regarded as an analogue of local complementation 
for qubit graphs; note however that we have not shown 
(as is true for the qubit case) that all graphs equivalent 
under local Clifford group operations are similarly equiv- 
alent under such transformations. This has been proven 
elsewhere [14]. 

An example of the effect of local measurement is given 
in Fig. [2] for a 4-party square state with d = 5, all edges 
of weight 2 and each vertex having the labels (z, x, m) = 
(1,0,1). If player 1 performs a measurement of XZ^ and 
gets a result of , the state is transformed as shown. 
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E. Dependence and access 

We now consider conditions such that a subset of play- 
ers can independently recover a secret encoded into the 
labels of a labelled qudit graph state, usingthe terminol- 
ogy previously employed for the qubit case |6| . For a state 
\Gt){Gi\: consider a subset of players V C V. Without 
any assistance from any other players the subset V only 
has access to the reduced state pv = Trv\v' \Gt) {Gt \ and 
must recover the secret from this state. 

Considering then some secret s G F^;, which is a func- 
tion of the labels t, it follows that the set of players V 
are clearly unable to recover s if the state py is invariant 
under changes in k. If this is not the case, we say the 
reduced state is dependent on the value s. 

However, dependency is generally insufficient for the 
players to be able to recover s. We say that a set of 
players V can access s if there is a measurement protocol 
the players in V can perform on py such that the value 
of s is revealed to them with certainty. 

We find the following: 

Proposition 2. Given an encoded graph state, if for a 
set of vertices V C V, we have some corresponding set 
of values {wi} G ¥d (with Wi — for all ^ V) then 
J2i WiZi is accessible to the parties in V via LOCC if 
Y.sj,e\i = foi' all e V \ V. 

Proof. Each party v.; G V measures K^^ for an overall 
stabilizer K = W^, ^y, Kf^ . The graph state is thus an 

eigenstate of K with eigenvalue ; thus the par- 

ties in V can jointly retrieve WiZi. □ 

Corollary 3. In an encoded graph state, the label Zk is 
accessible via LOCC by V if V contains and all of its 
neighbours. 

Proof. Apply Proposition [2] with Wk — ^ and all Wi^k — 
0, so that ^j^WiZi ~ Zk- For any Vj G V \ V, we have 
that X^e 6e''^«^ij ~ ^kj — sincc Vj is outside V and 
thus not a neighbour of v^. The stabilizer K in the proof 
of Proposition [5] is just Ki in this case; hence measuring 
Ki gives the value z^. □ 

Note that, because labels are applied to a given ver- 
tex via local Pauli operations on that vertex, the reduced 
graph state obtainable by tracing out a given vertex (i.e. 
a given player) must be independent of that vertex's la- 
bels. Hence those labels are inaccessible to the remaining 
players. We exploit this property to determine the min- 
imum number of players required to recover a secret in 
threshold secret sharing protocols. 



1. Label "shuffling" 

As for the qubit case, we demonstrate that a given sub- 
set of parties is independent of a particular qudit label by 
"shuffling" the label onto qudits not in the subset. That 



d = 5 

(3,0,0) (0,0,0) (0,0,0) 

T) — a 



Shuffle 1 ^ 2 




(0,0,0) 



(0,0,0) 



(2,0,0) 



(0,0,0) 



FIG. 3. Effect of label shuffling from vertex 1 to 2 on an 
encoded square qudit graph with weight-2 edges in d = 5. 
Labels are denoted {z,x,m). Vertex I's z label is set to 0. 
Vertex 2's x label is set to —3/2 — 1 (mod d = 5), and vertex 
3's z label is set to —6/2 — 2. 



is, we demonstrate that the transfer of the label onto 
a different qudit (such that the original qudit no longer 
has any dependence on the label) results in a physically 
equivalent state. Thus the label shuffiing procedure does 
not represent any physical operation or change in the 
state: it merely generates an equally valid relabelling of 
the same physical state. 

Proposition 4. Let |G^) be an encoded graph state, 
and let players i and j be neighbours. Then jG^) is 
equivalent to the labelled graph state |G^') where vertex 
i is relabelled z- = 0, vertex j is relabelled {Zj,x'j) = 
{zjj—AYj^Zi), and each neighbour k of j is relabelled 
z'k — Zk — A^J^AjkZi). 

Proof. Noting that Kj stabilizes \Ge}, it follows that 

Kj " '\Ge) cx |Gf'), which, from (fTTj). corresponds to 
the above relabelling. □ 

We demonstrate the above concept in Fig. |3] using a 
4-qudit square graph with weight-2 edges in d = 5, with 
a label of z = 3 on vertex 1 and all other labels equal to 
zero, and shuffiing player I's label to player 2. 



III. SECRET SHARING PROTOCOLS 

A. CC scheme 

In a (fc, n) CC threshold scheme, the players' shared 
quantum state is privately transferred to them by the 
dealer, after which a classical secret can be reconstructed 
by any fc of n players (but no fewer) using classical chan- 
nels between the players. We demonstrate the feasibility 
of such schemes using labelled graph states by encoding 
a secret "dit" s on to the z labels of certain vertices of 
the graph. We then show that a subset of m parties may 
measure s by jointly measuring one of the graph state's 
stabilizers Ki. Finally, to demonstrate that fewer than 
m parties cannot obtain s, it is sufficient to show that 
we can shuffle the vertices' z values such that any given 
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FIG. 4. Shuffling of a classical secret s from player 1 to player 
3 in a CC protocol for an encoded tree state. As this label 
can be shuffled to any player (or remain with player 1), any 
subset of the parties has no dependence on s. 

set of fewer than k parties has no dependence on s (for 
which it is clearly sufficient to demonstrate the above for 
k — 1 parties only) . 

Note that secret sharing is known to be information- 
theoretically secure in the classical case; in our analysis 
we are showing that such protocols may be unified within 
the graph state formahsm. CC protocols within our for- 
malism also provide a useful basis for the CQ and QQ 
cases, as shown later. 

We find that such schemes may be implemented for 
d-dimensional analogues of all the qubit states for which 
it was previously demonstrated [^J, using essentially the 
same reasoning. 



1. (n,n) CC protocol in the tree state 

We can implement an (n, n) protocol using a tree state, 
consisting of a single vertex connected by weight- 1 edges 
to n — 1 additional vertices, as illustrated in Fig. S) (In 
the 3-party qubit case with all labels set to zero this is the 
well-known Greenberger-Horne-Zeilinger-Mermin state). 
We set zi = s and Zi = for all i 7^ 1. For this state, 
the stabilizer Ki = {XZ™'-)i Z2® ■■■ ® has the 
eigenvalue w"'*, and the value of s may thus be accessed 
through local measurements by all n parties. 

We see that s is inaccessible to any smaller number 
of parties as follows: The set of n — 1 parties excluding 
player 1 has no dependence on s. However, we can also 
shuffle the s dependence from player 1 to any other party 
i as described in Proposition 21 This leaves us with zi = 
0, Xi = —zi = — s, and all other labels unchanged, in 
which case the labels for all players other than i have no 
dependence on s. Hence all n players are necessary to 
recover s. 



2. (2,3) CC protocol 

We can implement a (2,3) protocol using the labelled 
graph state in Fig. [51 We encode the classical secret 




(25,0,0) (5,0,0) 

FIG. 5. Encoding of a classical secret s £ Fd onto a three- 
party state to enable a (2, 3) CC protocol. It can be seen that 
the secret can be shuffled away from any single qubit. At the 
same time any two players can access the secret as explained 
in the text. 



s € Frf by setting zi = 0, Z2 = 2s and z^ — s and set all 
other labels to zero as illustrated. 

To see that no single player can access the secret we 
apply the shuffling as described in Proposition 3. Player 
1 cannot access the secret, as he has no label-dependence 
on the secret. The label Z2 = 2s can be removed by 
shuffling it to player 1 and player 3 as per Proposition 
3 (explicitly by multiplication of stabilizer K^^^)\ hence 
player 2 cannot access the secret. The label z^ — s can 
be removed by shuffling it to player 1 and player 3 as per 
Proposition 3 (explicitly by multiplication of stabilizer 
A'f '*), hence player 3 also cannot access the secret. 

To see that any pair can access the secret, we take each 
pair separately. Players 1 and 2 can measure K2 = Z1X2, 
giving outcome w^^^. Players 1 and 3 can measure = 
Z1X3, giving outcome o;"^. Players 2 and 3 can measure 
K^'^Ka = X^'^Xs, giving outcome w". 

3. (3,4) CC protocol in the ring state 

We can implement a (3,4) protocol using a square en- 
coded graph state with weight- 1 edges and mi — Q for all 
i, by setting Zi = s for all i. 

Thus we have Ki = uj^" for all i and e.g. K2 — 
Z\X2Z-i, so players 1, 2 and 3 can collaborate to measure 
s. By the symmetry of the state, this is similarly the case 
for any set of three players. 

As depicted in Fig. [6l we can shuffle the s dependence 
of player 1 to player 2. This sets z\ = 0, a;2 = — s and 
2:3 = s — s = 0. This leaves the labels of 1 and 3 inde- 
pendent of s; hence neither they, nor (by symmetry) any 
two nonadjacent parties, can obtain s. 

If they subsequently perform a 4 — 3 shuffle, this 
leaves player I's labels unaltered and sets player 4's z 
label to 0; hence 1 and 4 (and thus any two adjacent 
players) cannot obtain Z , thereby completing the proof. 

4. (3,5) CC protocol in the ring state 

We can implement a (3, 5) protocol using a 5-vertex 
ring-shaped encoded graph state with weight-1 edges, as 



Zi ^ -s Zi = (x2 = -s) 




11 11 




FIG. 6. CC protocol in an encoded (3, 4) ring state. All 
players start with z = s. Dependence on the label s can be 
shuffled such that any two a) nonadjacent or b) adjacent par- 
ties are independent of the label. Note that the the shuffling 
in b) occurs after first performing that in a) 



X\ —s 




X4 — s- — 5 Z3 ^ 



FIG. 7. CC protocol for an encoded (3, 5) ring state. All 
players start with z = s. Dependence on the label s can be 
shuffled such that any two adjacent parties are independent 
of s (see Fig. |8] for nonadjacent parties. 

shown in Figs. [7] and IH setting mi — for all i and z,; — s 
for all i, so again a Ki measurement yields a;~^ for all i 
and, for example, K2 = Z1X2Z3 so players 1, 2 and 3 
(hence any three adjacent parties) can measure s. 

The other possibility is where only two of three players 
are adjacent, e.g. 1, 2 and 4. For the ring state we have 

Ki = XiZi^iZi-i (29) 

so 

KiK2K^^ = XiZ2X2ZiX^\ (30) 

which can be measured by players 1, 2 and 4, giving uj~'^ . 
Hence any 3 parties can recover s. 

In the 5-qudit ring state we can always renumber the 
parties such that for two parties i and j, i + 1 < j < i + 2. 
In this case i and j can shuffle their s dependence to the 
parties i — 1 and j + 1 ; hence two players are not sufficient 
to recover s. 




FIG. 8. Shuffling of the label s such that any two nonadjacent 
parties are independent of s, for the (3, 5) ring state. 



dealer and a subset of the players end up securely shar- 
ing a random secret dit s. This shared random classical 
information can then be used by these parties to securely 
share any specified secret of the same length via standard 
classical cryptography protocols. 

We implement such QKD protocols in graph states by 
having the dealer distribute the players' qudits to them 
over public channels, after which the dealer and the play- 
ers measure their own qudits using bases chosen at ran- 
dom. After measurement the dealer and players publi- 
cally announce their bases and only retain their measure- 
ment results for certain combinations of chosen bases, 
such that m of the players may collaborate to obtain a 
classical secret shared with the dealer. 

The CQ protocols we have found follow a pattern 
whereby the result of the dealer's measurement is a pro- 
jection of the resultant reduced graph into a labelled state 
whose labels are correlated with the dealer's measure- 
ment, and for which the players can perform a CC pro- 
tocol. 

As in Q , our protocol is based on that of Hillery, Buzek 
and Berthiaume Q and has the same limitation of being 
secure against certain classes of attack such as intercept- 
resend attacks by an eavesdropper or certain classes of 
attack by dishonest participants [3|, but not against all 
attacks by dishonest participants [29|. Additionally, we 
do not consider the case of noisy channels, although exist- 
ing protocols which do [13] could potentially be adapted 
to our model. 



1. (n, n) CQ protocol vn the extended tree state 



B. The CQ scheme 

As in we implement CQ schemes by performing a 
quantum key distribution (QKD) protocol, wherein the 



We can construct an (n, n) CQ protocol using an "ex- 
tended" tree state, consisting of an n-party tree state (as 
in the CC protocol) with the dealer's qudit connected to 
player I's qudit by a weight- 1 edge and all labels set to 
0, as illustrated in Fig. [HI This graph state therefore has 
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FIG. 9. The "extended" tree state used for the CQ protocol. 
Local measurement on the dealer's qudit produces a reduced 
state of the form of that in Fig. |4] (although with an additional 
m = to label on vertex 1.) 



stabilizers 

Kd = XdZi (31) 
Ki = ZdXi II Z, (32) 

K,^X,Z^ + (33) 

In our protocol, the dealer and the players 1, . . . , n each 
independently randomly choose a value tD,ti, . . .tn € F^. 



The dealer then measures her qudit in the basis X'^Z, 
player 1 measures XZ*^ whereas the remaining players i 
each measure X*'Z. 

If the dealer's measurement result is then, from 
Proposition [H the reduced state of the remaining n par- 
ties is the nGHZM state (without the additional dealer's 
vertex), still with weight-1 edges. The only relabelled 
vertex is that of player 1, with zi — s, mi — to- AH 
other labels remain zero. The reduced graph therefore 
has stabilizers 

fci - (XZ*°)iZ2---Z„ (34) 
h = ZiX„ i ^ 1 (35) 

(here and henceforth we use ki to denote reduced-state 
stabilizers and Ki for the full state including the dealer). 
Furthermore, the labelling is such that the reduced state 
has eigenvalue 1 for all the stabilizers with i ^ \. Thus 
any product of stabilizers fcifcj^ ' ' ' ^n" ^^^^ have eigen- 
value a;~*. As 

{XZ{), \{{X'^Z\ = k.k'i ■ ■ ■ (36) 

the players measure such a product (and hence are able 
to recover s) if ti = to + t2 + ■ ■ ■ + tn, which occurs with 
probability l/d. 

Security against an eavesdropper having tampered 
with the qudits (e.g. an intercept-resend attack) is es- 
tablished by noting that the combination of the player 




FIG. 10. a) The "extended" (2,3) state used for the CQ 
protocol. Local measurement on the dealer's qudit produces 
a reduced state of the type in b) 

and dealer's measurements satisfies 

iXt^Z)DiXZl), UiX'^Z), = i^iif*^ • • • if*"; 

(37) 

i.e. the players and dealer can also combine their mea- 
surement statistics for the various values of ti to measure 
the stabilizers of, and hence verify, the original state. 

2. (2, 3) CQ protocol 

We can construct a (2, 3) CQ protocol through extend- 
ing the CC case by attaching the dealer's qudit to those of 
players 2 and 3 with weights of two and one respectively 
and setting all labels to zero, as illustrated in Fig. (TU] 
The stabilizers for this state are 

Kd = XdZIZ^, (38) 

= XiZ^Z^, (39) 

K2 = ZIZ1X2, (40) 

if3 = ZdZIX^. (41) 

The dealer randomly selects a variable to e and mea- 
sures X*"Z, and obtains result lu". The resultant graph 
states are given by Proposition 5, as shown in Fig. [10] b), 
with stabilizers 

= (42) 
k2^tn = ZiX2Z^'^Zl'^, (43) 
fc3,t„ =ZiZf°X3Z*-. (44) 

We now need to see how sets of players can or cannot 
access the random value s of the dealer's measurement 
result. First, for any choice oi to, no single player can 
access s by application of Proposition 3 to Fig. [TU]b). To 
see how any pair can access the dealer's result, we must 
address each measurement parameter to and resultant 
graph separately and see which measurement the players 
would ideally make. In the protocol, any given authorised 
set of players then choose randomly one of these possible 
measurements, which sometimes match that of the dealer 
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and enable this set of players to access the secret and 
in addition provide security by effectively measuring a 
stabilizer of the total state Fig. [10] a) . 

We now go through how each pair can access s if the 
dealer measures as above. Players 1 and 2 can access the 
dealer's result by measuring 

allowing them to obtain 0;"^^*+^*°^ Players 1 and 3 
would measure 

allowing them to obtain 0;^'^"+*"^ Players 2 and 3 would 
measure 

allowing them to obtain uj^(^+^*o)_ 

In this protocol, each authorised set will measure ran- 
domly from one of the three possible measurements cor- 
responding to tz). For example, if players 1 and 2 decide 
to work together to obtain the secret, they will randomly 
measure 

by choosing their random variable t'j^ (agreed between 
players 1 and 2). By definition of the stabilizers these do 
not commute, hence cannot be measured simultaneously. 
Their measurements will coincide with the dealer's when 
t'o = ^-D: which happens with probability 1/d. After an- 
nouncing the bases they can then throw away all results 
that do not coincide. 

Security can be proven by noting that including the 
dealer's measurement results allows the dealer plus an 
authorised set to simulate measurement of stabilizers of 
the original graph Fig. [TUla). An additional subtlety of 
simulating measurements locally in the qudit case, as ap- 
posed to the qubit case, is that there is more than one 
possible commuting Pauli. Any local extended Pauli on 
a qudit i, Oi, commutes with all powers of this Pauli op- 
erator O™, which means they share common eigenbases. 
Further, as there are no degeneracies, the eigenvalues are 
just a re-ordering. Thus, if measuring Oi yields result 
w", we know that, even without doing any further mea- 
surement, would give result cj""*. In this way, we can 
simulate any power of a Pauli O™ just by measuring Oi. 

In the protocol, some of the sifted key would be sac- 
rificed now to check the security by announcing some 
randomly chosen results. If we again look at players 1 
and 2 for example, by combining their results with those 
of the dealer, they can simulate measuring stabilizers Ki 
of the original state fFig. fTUb). equation P^ - H ^ . since 

K2toj^-2tnj^^ = LJ^'"{X'j,"ZDfk-;'^l"k2,tn- (45) 

If there has been no interference from an eavesdropper, 
they will all measure outcome 1 for, with high probability 




FIG. 11. The "extended" (3,5) state used for the CQ pro- 
tocol. Local measurement on the dealer's qudit produces a 
reduced state of the type in Fig. 1121 

given a large number of announced results, every value 
oi to- Although this outcome is not enough to guaran- 
tee that the state before measurement was the state of 
Fig. [TU]a), it restricts the allowed space to that which 
guarantees security as follows: if g is the subgraph got 
by removing player 3 and all its edges from Fig. [TUl a), 
having eigenvalue 1 for all these stabilizers implies that 
the state of the dealer plus players 1 and 2 is in the sub- 
space spanned by {gz={i,i,o)} i-S- where players 1 and 2 
have zi = Z2 and players 3 has Z3 = 0. Thus, the most 
general state including an eavesdropper E can be written 

X!"»l*)s|5z=(i,»,0))D,l,2i (46) 

i 

It can then be checked that the reduced density matrix 
of the dealer and the eavesdropper is 

PED PE® to/d, (47) 

which implies that the eavesdropper cannot share any 
information about the dealer's results. It can similarly 
be checked for pairs of players 2 and 3, and 1 and 3. 

3. (3,5) CQ protocol 

We can construct a (3, 5) CQ protocol by extending 
the CC case by attaching the dealer's qudit to each player 
with weight one edges, and all labels set to zero, as illus- 
trated in Fig. [TTJ The stabilizers for this state are 



Kd = XuZxZ^Z^Z^Z^ (48) 

ifi = ZdX^Z^Z^ (49) 

K2 = ZDZ1X2Z3 (50) 

K3 = ZDZ2X3Z4 (51) 

Ki - ZDZ3X4Z5 (52) 

- ^13^1^4X5 (53) 



The dealer randomly selects a variable G and 
measures and obtains result w'*. The resultant 

graph states are shown in Fig. [T^ The associated stabi- 
lizers of player i are denoted ki^to ■ 
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l+tD 



FIG. 12. Resultant state from the dealer's local measurement 
on Fig. \TT\ 



First we check that each pair of players cannot access s 
without collaborating with the others. From Proposition 
3, players 1 and 2 cannot access the dealer's result (the 
secret) as explicitly by application of the stabilizers 



k 



(shuffling from player 1 to 4) if t/) 7^ or 

^3, to ^5, to 

(shuffling from 1 to 5 and 2 to 3) if = 0. We can see 
that players 1 and 3 cannot access s since the dependence 
can be removed by application of 

, -(s + tD)(l+tD)~' 

(shuffling from 1 to 2) if i_D + 1 7^ or 

(shuffling from 3 to 4 and 1 to 5) if + 1 = 0. By 
symmetry no pair alone can access s. 

We now see how any three players can access the secret 
for a given to- Players 1, 2 and 3 can do so by measuring 

1, — to j,l+2ir) i,~to 

yielding result Players 1, 3 and 4 can do so by 

measuring 

, -(l + 2tD), l + l + tB 

yielding result By symmetry any three players 

can therefore find s. 

In this protocol, any set of authorised players measures 
randomly in accordance with these procedures. For ex- 
ample Players 1,2 and 3 will randomly measure stabilizers 

by choosing a shared random variable t'j^. Security is 
then checked by verifying that the eigenequations are 
satisfied by the dealer and the player, by communicating 



results to simulate measurement of a subset of stabilizers. 
For example, the dealer plus players 1, 2 and 3 can, by 
comparing results, calculate what would have been the 
measured value for the stabilizers (of the original graph 
Fig.[TTl equation (|48ll53p ). because 



l+2t' 



t'n 7 l+2t' 



(54) 
(55) 



If the eigenvalue is 1 for all of these (as should be the 
case; if not the protocol restarts), this implies the joint 
state of the dealer plus players 1, 2 and 3 is in the sub- 
space spanned by {\gz={i+j, 1,0,3)) 0,1,2.3}- for the (2, 3) 
case, this implies that, for the most general state of an 
eavesdropper E and dealer, their reduced density matrix 
is of the form 



Pe,d ^ Pe® ^o/d; 



(56) 



hence the eavesdropper's state is completely uncorrelated 
with the dealer's measurement result and therefore un- 
correlated with the secret. Security can similarly be 
checked for all sets of three or more players. 



C. The QQ scheme 

The QQ scheme proposed in Q is readily generalisable 
to qudits. This protocol is similar to the CQ scheme, 
but the secret to be shared is now a quantum state |s) 
in a d-dimensional Hilbert space, initially possessed by 
the dealer, who distributes it to the other parties via a 
joint operation on the secret state and the parties' shared 
graph state, in a manner analogous to quantum telepor- 
tation. We describe the general protocol explicitly below. 

Denoting the dealer's secret qudit as 



\s)d = ^a,\i)D, 



the dealer prepares the state 
\s)d\G) 



D,V 



(57) 



(58) 



corresponding to some graph state G for the dealer's qu- 
dit D and all the players' qudits V. The dealer distributes 
the players' qudits to them (over perfect quantum chan- 
nels, which we can assume to be public). The dealer then 
measures her two qudits in the generalized Bell basis [3l| 
{IV'mn)}, where 



(59) 



If the dealer's measurement result is {m,n), corre- 
sponding to the state \ipmn)^ then it follows from our 
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rules for projective measurement that the resultant state 
for aU parties is 

I V""!" ) -D ( V'mn 1 1 s) _D I G) D , V 

= {j + m){ADl,AD-2---,ADN)/V 

(60) 

where \gz) is the encoded reduced graph state on the 
players 1, . . . , n with labels z. 

If the dealer informs the players of their measurement 
result {m,n), then a set of players e V (including some 
player a with Njja 7^ 0) can apply a correction operator 

Umn (61) 
to obtain the state 

1*9)^ = ^OLj\g^^j^Aoi,...AuN))v ■ (62) 
j 

The access properties of this final state depend on the 
graph state used. Qualitatively, for certain initial graph 
states, the state \sg)^ can be regarded as a superposition 
(with coefficients corresponding to those of the encoded 
secret) of orthogonal labelled graph states whose labels 
have the same access structure as CC protocols. Thus, 
the ability to recover the quantum secret corresponds to 
the ability to recover these classical labels, providing a 
natural extension of the classical protocols to the quan- 
tum case. 

However, the above reasoning does not guarantee that 
such a QQ protocol will have the same adversary struc- 
ture as the corresponding CC protocol, as seen below, 
where we achieve "perfect" threshold schemes in the 
(2,3) and (5,3) cases, but fewer than n players can still 
obtain some secret information in the {n, n) case. 

1. (n, n) QQ protocol using the nGHZM state 

If the joint graph state of the dealer and players \G) 
is the same as for the CQ scheme (i.e. an nGHZM state 
with an additional dealer's vertex, connected to player 1, 
and all labels set to zero), then the final players' state is 

\^a)v ^^a]\9z=(]fi,...fl))v (63) 

where V is the set of all players. The \g) states, in the 
form of nGHZM states with a label on player I's vertex, 
are the same as those used in the (n,n) CC protocol, to 
which the access properties described in Sec. IIII A II ap- 
ply, and fewer than n players cannot perfectly reconstruct 
the secret. 

However, we note that the reduced states of fewer than 
n players are not independent of the aj. For example, 
in the analogous qubit protocol ^ we can, in some basis 



(depending on the player), express the reduced state of 
a single player as diagd^o + ctiP, |ao — Q^iP)- Thus this 
(n, n) protocol is not a "perfect" threshold scheme; it 
allows some incomplete information to be accessed by 
fewer than n players. 

However the secret qudit is clearly encoded within the 
state of the n players and so may be accessed by all play- 
ers by performing joint quantum operations. Further- 
more, the secret can be isolated to any individual player 
through LOCC,as follows. 

For any player i other than player 1, the secret can 
be isolated by player 1 measuring X and the rest of the 
players other than i measuring Z, which is evident by 
rewriting the state as 

3 k 

The secret can be isolated to player 1 by every player 
other than 1 measuring Z , thereby producing the state 

k2 fen j 

X + fc2 + • • • + fcn))l|fc2)2 • • • \k„)n. (65) 

Thus the quantum secret requires collaboration by all 
n players (and no fewer) to recover but the players may 
collaboratively make the secret locally accessible to a sin- 
gle player if they so wish. 

2. (2,3) QQ protocol 

We can construct a (2,3) QQ protocol by teleporting 
the secret qudit ([57)1 into the extended graph state of 
Fig. [TOl The encoded state is 

d-l 

\'^9)v = Xl"jl5^=J(0'2,i)) (66) 

for g the (unlabelled) graph in Fig. [S] The state (1551) can 
be rewritten as 

^^..fe-=o 

d-l 

= ^ E c.,\M-j),\MTj)2\Mh (67) 

where M ~ j + k. 

For d = 3 this state corresponds exactly to the (2,3) 
qutrit code presented in |^]. Any pair of players can 
thus access the secret, and any single player cannot. For 
example, players 1 and 2 perform control operations that 
add the value of the first register (without an overbar) to 
the second register (with an overbar), and then — ^ times 
the value of the second to the first (again, keeping the 
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first register non-barred and the second always barred). 
This leaves the resultant state as 



d~l 



M=0 



(68) 



Any pair can similarly obtain the secret. Since single 
players form complementary sets to pairs of players, it 
follows from information gain implying disturbance Q 
(and can be shown explicitly) that no single player can 
obtain any information about the secret, so this is a per- 
fect threshold scheme. 



3. (3, 5) QQ protocol 

We can construct a (3, 5) QQ protocol by teleporting 
the secret qudit into the extended graph state of Fig. [11] 
The encoded state is then 



3=0 



(69) 



where g is the (unlabelled) graph of Fig. [T] The state 
can be rewritten as 



^ d-l 



x,y—0 

(70) 

where h is the subgraph corresponding to players 3, 4 and 
5 taken by removing all other vertices and their edges. 
The fact that each vector z occurs only once means that 
players 3, 4 and 5 can always measure in such a way to 
project them only onto the a subspace corresponding to 
some \xy)i 2- Each would occur with equal probability 
of 1/^2. 

If for example their measurements put them onto the 
\hz={j,jj))3,4,5 subspace (corresponding to a; = y = 0), 
they know from the above that they would obtain the 
state 



d-l 
j=0 



(71) 



hence would have the secret encoded into the graph state 
\h) . Suitable global operations could then be used to map 
the state onto any subsystem they liked. For example 
performing {Cab)~^ between players 3 and 4, as well as 
between players 4 and 5, gives the state 



Yoij\j)3\j)i\j)5- 



(72) 



Players 3 and 4 can measure in their respective Z bases, 
to shuffle the information to player 5. Similarly it can be 
shuffled to any player. 

To see how players 2, 4 and 5 can access the secret 
qutrit, we rewrite the state as 



d-l 



\sa)v 



1 E \-)^\yh 



x.y—O 
' d~l 



j=0 



(73) 

where h is the subgraph of players 2, 4 and 5 found by 
removing all other vertices and their edges. Each possi- 
ble vector z occurs only once in this expansion. By the 
same tactics players 2,4 and 5 can access the secret. By 
symmetry, any three can access the secret. As with the 
(2, 3) case, perfect secret recovery by 3 players requires 
that the complementary sets of 2 players cannot obtain 
any information about the secret (as can also be shown 
explicitly), so this is a perfect threshold scheme. 

We note that the existence of a (3, 5) QQ protocol 
in graph states of arbitrary dimension has been implied 
by the work of Gheorghiu, Looi and Griffiths 02i, who 
showed that encoded information can be isolated to 3 of 
the 5 qudits in a graph state. 



IV. CONCLUSION 

We have developed a unified framework for the three 
types of secret sharing in prime-dimensional Hilbert 
space. Our formalism uses prime-dimensional graph 
states, analogous to those in the qubit case, and our 
protocols allow sharing of classical "dits" and prime- 
dimensional quantum states as secrets. Our protocols in- 
clude the case of (2, 3) sharing, which was not achievable 
in the qubit formalism in addition to higher-dimensional 
analogues of qubit protocols. Our work provides a use- 
ful step towards describing schemes sharing classical and 
quantum secrets of any size within a graph-state formal- 
ism for general physical systems. 

Our work suggests several areas for further research. 
Still open are the questions of whether any achiev- 
able threshold secret sharing scheme can be constructed 
within our formalism, and, if so, what the associ- 
ated graph states and protocols would be. If prime- 
dimensional systems are not sufficient to construct any 
scheme, it is possible that an analogous formalism in- 
volving states of any dimension might allow for a richer 
array of protocols, as we have shown occurs when moving 
beyond the qubit case. Generalising to the case of arbi- 
trary d is thus another promising area for further work, 
and some of the methods described in [32!| (which con- 
siders such general graph states) may be useful here. 

With regard to achieving arbitrary threshold schemes, 
we additionally note that the graph state formalism can 
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in principle be used for sharing of quantum secrets for 
arbitrary access structures. This property of the formal- 
ism stems from the fact that schemes exist for arbitrary 
access structures using high-dimensional stabilizer states 
[3, i5i] , and that it can be shown that all stabilizer states 
are locally equivalent to qudit graph states [l3,|33|. How- 
ever there is no explicit procedure for converting these 
schemes to graphs, and further, it is not immediately 
clear that they can also be used for sharing classical se- 
crets (though it seems very likely). Developing such a 
procedure would provide a graph state formalism for ar- 
bitrary access structures in quantum secret sharing, al- 
though it may not be equivalent to that in our current 
work. 

There are also several possible extensions to the anal- 
ysis of CQ protocols within our formalism: considering 
more general attacks involving dishonest participants, 
the presence of channel noise, and the overall efficiency 



of the protocol; i.e. the need to discard states when the 
participants' bases do not match. It is an open question 
which graph states would produce the highest key rates 
(and hence secret-sharing rates) per state within our for- 
malism. 

Further generalisation may allow a wide range 
of secret-sharing schemes to be described in this 
intuitively-appealing way. 
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